Credential encryption
Stored credentials are encrypted using AES-256-GCM. Each agency workspace has its own encryption key, protected by AWS KMS in the live service. Encrypted credentials are tied to their workspace and intended use.
Grant-only credentials
Client sign-in credentials used only to grant access are eligible for scheduled deletion after 24 hours from creation, or 24 hours after the associated grant leaves its pending state. The scheduler must run for removal to occur. Credentials for approved ongoing work are handled separately. We do not describe all platform tokens as immediately discarded after granting access.
Agency workspace separation
Database protections keep each agency’s records within its workspace. Dashboard actions require membership and the appropriate role. These checks apply to agency, client, request, and enquiry records.
Sign-in and public requests
Agency sign-in uses verified authentication and requires two-factor enrollment for protected work. Public submissions use Cloudflare Turnstile and rate limits. Client access requests use sensitive, expiring links; keep them out of public channels.
Verification you can interpret
An agency-side verification result is distinct from client confirmation or a pending task. The service records events so your team can follow the handover. A status cannot guarantee that permissions will never be changed later in the original platform.
Your part in protecting access
Use the least access your work needs, check the agency and account identifiers, keep recovery codes private, and revoke access in the original platform when a working relationship ends. Do not put passwords or tokens in enquiry or privacy forms.
Report a concern
Use the business enquiry form to report a security concern and provide a safe contact email and a short description. Do not include live credentials, personal client data, or exploit details in the first message. The team can coordinate a suitable follow-up.